Response to the ICO Consultation on the Draft Data Sharing Code of 
Practice 


The ICO’s Data Sharing Code of Practice (CoP) helps to clarify the requirements and provide 
practical guidance to organisations on sharing personal data whilst still complying with the relevant 
data protection legislation; namely the Data Protection Act 2018 and the General Data Protection 
Regulation.2 This guidance is welcomed by the author. Rather than seeking to discuss every aspect 
of the CoP, this response focuses its discussion on the CoP’s application to sharing data in the 
context of research. 


It is reassuring to see that the ICO has sought to make reference to the sharing of data for research 
purposes within its updated CoP. However, there are a number of areas centering around research 
and the sharing of personal data which would benefit from being explored further in the CoP by 
the ICO. 


One of the areas that the CoP appears to lack discussion of — which would likely offer a tangible 
benefit to researchers — is the collection of personal data for the primary purpose of research. The 
example in the CoP (under Annex D ‘Case Studies’) around research and using shared data focuses 
primarily on data which has been collected for one purpose which is then shared and reused for 
another purpose; namely, research. There is an abundance of personal data that is originally 
collected for research purposes and it would be useful to have an illustrative example or case study 
around this within the CoP. However, within academia, there has also been a heavy acceleration of 
the open science and open research agenda, from universities, funding bodies, publishers and the 
government to make research data more open, reproducible and shareable with other 
researchers,3 to help prevent the need to reproduce data which has been collected before. Again, 
the current update to the CoP it is an ideal opportunity to address this, and one that should not be 
missed by the ICO. 


One way to address this in the CoP would be to highlight the importance of depositing research 
data (where permissible) with a data repository at the end of a research project. The depositing of 
data at the end of a project into a dedicated archive or repository will then permit that research to 
be reused, and for others to validate the authenticity of the original research. It used to be the 
case that the primary means of sharing research data was by way of informal transfers on an ad 
hoc basis, but now — with the push for open and replicable data — researchers have the option to 
deposit research data in repositories which are a more secure, fairer and transparent way to share 
research data. Research data repositories, such as the UK Data Archive, can provide safe and 
secure access to existing project data. Research data will often contain a degree of personal data 
that cannot be completely removed without significantly reducing the reuse value of such data. 
Taking qualitative interview data as an illustrative example: whilst a researcher may be able to 
remove the direct identifiers and various indirect identifiers within the data, there will likely 
remain a ‘story’ within the interview, which means that someone who knows the interviewee 
could potentially identify them. This is where the benefits of research data repositories and 
archives can be realised. A multi-pronged strategy is used by archives to provide secure and safe 
access to research data: namely, (i) a degree of anonymisation (or de-identification) of the data; (ii) 


2 Hereafter, the DPA 2018 and the GDPR. 


3 The Research Councils UK Common Principles on Data Policy are accessible at http://www.rcuk.ac.uk/research/datapolicy/. 
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participant consent for the sharing of certain data for research or teaching purposes; and (iii) 
regulated access to the data where necessary, through access agreements (which require 
researchers who reuse the data not to seek to re-identify individuals in the data if they are 
identifiable). 


Through gaining participants permission to share research data and explaining the benefits, risks 
and safeguards, it helps researchers to comply with the transparency and accountability 
requirements of the GDPR and the DPA 2018. 


It is also important that the CoP makes clear to researchers that data protection legislation does 
not prohibit them from archiving and sharing their data for future research use and it does not 
require them to destroy all of the data at the end of their project. Unfortunately, this is currently 
happening, often by default, in many Higher Education Institutions due to lack of clarity on what 
the current data protection legislation actually demands. 


It is also promising to see that the CoP makes reference to ethics and data sharing. Whilst it is 
outside the scope of this response, it is worth noting that a great deal of the ethical concerns 
associated with sharing data — from a research perspective — have already been considered in 
significant depth, and it would be informative for the ICO to consult some of these, if they have yet 
to do so.4 


The updated CoP is highly welcomed, but could be enhanced further by providing greater 
guidance, examples and clarification from the point of view of research and data sharing. 


4 For example, the ESRC has developed detailed guidance around research ethics, namely their Research Ethics Framework (https:// 
esrc.ukri.org/funding/guidance-for-applicants/research-ethics/), and would be an excellent starting point. Others include the 
RESPECT protect (http://www.respectproject.org/main/index.php); the BSA Statement of Ethical Practice 2017 (https:// 
www.britsoc.co.uk/media/24310/bsa_statement_of_ethical_practice.pdf) and the SRA Ethical Guidelines (http://the-sra.org.uk/wp- 
content/uploads/ethics03.pdf). 


